{"id":"CVE-2026-33050","published":"2026-11-06T20:17:22.570","lastModified":"2026-11-09T13:17:08.360","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180","tags":[]},{"url":"https://github.com/GeoNode/geonode/releases/tag/5.1.0","tags":[]},{"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6","tags":[]}],"exploitRefs":[{"url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180","tags":[]},{"url":"https://github.com/GeoNode/geonode/releases/tag/5.1.0","tags":[]},{"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability in GeoNode prior to 5.1.0 allows low-privileged remote users to execute arbitrary OS commands by injecting shell syntax through a crafted vector file layer name during upload. This occurs because user-supplied input is improperly sanitized before being used in shell command execution.","exploitability":"Exploitation requires only low-privileged authentication and no user interaction, with straightforward payload construction due to lack of input sanitization.","blast_radius":"Successful exploitation grants full system compromise of the GeoNode server, enabling data exfiltration, lateral movement, or infrastructure disruption.","remediation":"Upgrade GeoNode to version 5.1.0 or later.","detection":"Defenders should monitor for unexpected shell command execution in application logs (e.g., lines containing 'sh', 'bash', 'cmd.exe', or system utilities like 'ls', 'cat' invoked via upload-related endpoints), especially when accompanied by non-standard layer names containing shell metacharacters such as ';', '|', '$(', or backticks.","tags":["rce","command-injection","webapp","auth-bypass","geospatial"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:51:47.608Z"}}